public/rancher-docs
1
0
Fork 0
mirror of https://github.com/rancher/rancher-docs.git synced 2026-09-25 04:28:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix tabs

Browse Source
This commit is contained in:
Billy Tat
2022-09-09 17:18:22 -07:00
parent fb7f0f8da9
commit ff9f59d0a0
4 changed files with 324 additions and 315 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/explanations/integrations-in-rancher/cloud-marketplace/aws-cloud-marketplace/install-adapter.md
+44 -41
View File
@@ -3,6 +3,9 @@ title: Installing the Adapter
weight: 2
---
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
> **Important:** If you are attempting to re-install the adapter, you may experience errant out-of-compliance messages for up to an hour.
### 1. Gain Access to the Local Cluster
@@ -63,62 +66,62 @@ For the below instructions, replace `$MY_ACC_NUM` with your AWS account number a
> **Note:** It is important that you follow the instructions below exactly. In particular, the command to install version 1.0.1 of the adapter (by using --set image.tag=v1.0.1) is key to ensure that node counts are accurate.
{{% tabs %}}
{{% tab "Let's Encrypt/ Public Certificate Authority" %}}
<Tabs>
<TabItem value="Let's Encrypt/ Public Certificate Authority">
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter --namespace cattle-csp-adapter-system --set aws.enabled=true --set aws.roleName=$MY_ROLE_NAME --set-string aws.accountNumber=$MY_ACC_NUM --set image.tag=v1.0.1
```
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter --namespace cattle-csp-adapter-system --set aws.enabled=true --set aws.roleName=$MY_ROLE_NAME --set-string aws.accountNumber=$MY_ACC_NUM --set image.tag=v1.0.1
```
Alternatively, you can use a `values.yaml` and specify options like below:
Alternatively, you can use a `values.yaml` and specify options like below:
```yaml
image:
tag: v1.0.1
aws:
enabled: true
accountNumber: "$MY_ACC_NUM"
roleName: $MY_ROLE_NAME
```
```yaml
image:
tag: v1.0.1
aws:
enabled: true
accountNumber: "$MY_ACC_NUM"
roleName: $MY_ROLE_NAME
```
> **Note:** The account number needs to be specified in a string format, like the above, or the installation will fail.
> **Note:** The account number needs to be specified in a string format, like the above, or the installation will fail.
You can then install the adapter with the following command:
You can then install the adapter with the following command:
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter -f values.yaml
```
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter -f values.yaml
```
{{% /tab %}}
{{% tab "Private CA Authority / Rancher-generated Certificates" %}}
</TabItem>
<TabItem value="Private CA Authority / Rancher-generated Certificates">
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter --namespace cattle-csp-adapter-system --set aws.enabled=true --set aws.roleName=$MY_ROLE_NAME --set-string aws.accountNumber=$MY_ACC_NUM --set additionalTrustedCAs=true --set image.tag=v1.0.1
```
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter --namespace cattle-csp-adapter-system --set aws.enabled=true --set aws.roleName=$MY_ROLE_NAME --set-string aws.accountNumber=$MY_ACC_NUM --set additionalTrustedCAs=true --set image.tag=v1.0.1
```
Alternatively, you can use a `values.yaml` and specify options the below:
Alternatively, you can use a `values.yaml` and specify options the below:
```yaml
image:
tag: v1.0.1
aws:
enabled: true
accountNumber: "$MY_ACC_NUM"
roleName: $MY_ROLE_NAME
additionalTrustedCAs: true
```
```yaml
image:
tag: v1.0.1
aws:
enabled: true
accountNumber: "$MY_ACC_NUM"
roleName: $MY_ROLE_NAME
additionalTrustedCAs: true
```
> **Note:** The account number needs to be specified in a string format, like the above, or the installation will fail.
> **Note:** The account number needs to be specified in a string format, like the above, or the installation will fail.
You can then install the adapter with the following command:
You can then install the adapter with the following command:
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter -f values.yaml
```
```bash
helm install rancher-csp-adapter rancher-charts/rancher-csp-adapter -f values.yaml
```
{{% /tab %}}
{{% /tabs %}}
</TabItem>
</Tabs>
### 5. Managing Certificate Updates
docs/explanations/integrations-in-rancher/neuvector.md
+42 -39
View File
@@ -3,6 +3,9 @@ title: NeuVector Integration
weight: 22
---
import Tabs from '@theme/Tabs';
import TabItem from '@theme/TabItem';
### NeuVector Integration in Rancher
New in Rancher v2.6.5, [NeuVector 5.x](https://open-docs.neuvector.com/) is an open-source container-centric security platform that is now integrated into Rancher. NeuVector offers real-time compliance, visibility, and protection for critical applications and data during runtime. NeuVector provides a firewall, container process/file system monitoring, security auditing with CIS benchmarks, and vulnerability scanning. For more information on Rancher security, please see the [security documentation](../../pages-for-subheaders/rancher-security.md).
@@ -11,13 +14,13 @@ NeuVector can be enabled through a Helm chart that may be installed either throu
### Installing NeuVector with Rancher
The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher where users can navigate directly to deploy and manage their NeuVector clusters.
The Harvester Helm Chart is used to manage access to the NeuVector UI in Rancher where users can navigate directly to deploy and manage their NeuVector clusters.
**To navigate to and install the NeuVector chart through Apps & Marketplace:**
1. Click **☰ > Cluster Management**.
1. On the Clusters page, go to the cluster where you want to deploy NeuVector, and click **Explore**.
1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo.
1. Go to **Apps & Marketplace > Charts**, and install **NeuVector** from the chart repo.
1. Different cluster types require different container runtimes. When configuring Helm chart values, go to the **Container Runtime** section, and select your runtime in accordance with the cluster type. Finally, click **Install** again.
Some examples are as follows:
@@ -29,11 +32,11 @@ Some examples are as follows:
- GKE: `containerd` (see the [Google docs](https://cloud.google.com/kubernetes-engine/docs/concepts/using-containerd) for more)
:::note
Only one container runtime engine may be selected at a time during installation.
:::
**To navigate to and install the NeuVector chart through Cluster Tools:**
1. Click **☰ > Cluster Management**.
@@ -102,63 +105,63 @@ Below are the minimum recommended computing resources for the NeuVector chart in
### Hardened Cluster Support - Calico and Canal
{{% tabs %}}
{{% tab "RKE1" %}}
<Tabs>
<TabItem value="RKE1">
- All NeuVector components are deployable if PSP is set to true.
- All NeuVector components are deployable if PSP is set to true.
**_New in v2.6.7_**
**_New in v2.6.7_**
You will need to set additional configuration for your hardened cluster environment as follows:
You will need to set additional configuration for your hardened cluster environment as follows:
1. Click **☰ > Cluster Management**.
1. Go to the cluster that you created and click **Explore**.
1. In the left navigation bar, click **Apps & Marketplace**.
1. Install (or upgrade to) NeuVector version `100.0.1+up2.2.2`.
1. Click **☰ > Cluster Management**.
1. Go to the cluster that you created and click **Explore**.
1. In the left navigation bar, click **Apps & Marketplace**.
1. Install (or upgrade to) NeuVector version `100.0.1+up2.2.2`.
- Under **Edit Options** > **Other Configuration**, enable **Pod Security Policy** by checking the box (no other config needed):
- Under **Edit Options** > **Other Configuration**, enable **Pod Security Policy** by checking the box (no other config needed):
![Enable PSP for RKE1 Hardened Cluster](/img/psp-nv-rke.png)
![Enable PSP for RKE1 Hardened Cluster](/img/psp-nv-rke.png)
1. Click **Install** at the bottom-right to complete.
1. Click **Install** at the bottom-right to complete.
{{% /tab %}}
{{% tab "RKE2" %}}
</TabItem>
<TabItem value="RKE2">
- NeuVector components Controller and Enforcer are deployable if PSP is set to true.
- NeuVector components Controller and Enforcer are deployable if PSP is set to true.
**Applicable to NeuVector chart version 100.0.0+up2.2.0 only:**
**Applicable to NeuVector chart version 100.0.0+up2.2.0 only:**
- For Manager, Scanner, and Updater components, additional configuration is required as shown below:
- For Manager, Scanner, and Updater components, additional configuration is required as shown below:
```
kubectl patch deploy neuvector-manager-pod -n cattle-neuvector-system --patch '{"spec":{"template":{"spec":{"securityContext":{"runAsUser": 5400}}}}}'
kubectl patch deploy neuvector-scanner-pod -n cattle-neuvector-system --patch '{"spec":{"template":{"spec":{"securityContext":{"runAsUser": 5400}}}}}'
kubectl patch cronjob neuvector-updater-pod -n cattle-neuvector-system --patch '{"spec":{"jobTemplate":{"spec":{"template":{"spec":{"securityContext":{"runAsUser": 5400}}}}}}}'
```
<br/>
```
kubectl patch deploy neuvector-manager-pod -n cattle-neuvector-system --patch '{"spec":{"template":{"spec":{"securityContext":{"runAsUser": 5400}}}}}'
kubectl patch deploy neuvector-scanner-pod -n cattle-neuvector-system --patch '{"spec":{"template":{"spec":{"securityContext":{"runAsUser": 5400}}}}}'
kubectl patch cronjob neuvector-updater-pod -n cattle-neuvector-system --patch '{"spec":{"jobTemplate":{"spec":{"template":{"spec":{"securityContext":{"runAsUser": 5400}}}}}}}'
```
<br/>
**_New in v2.6.7_**
**_New in v2.6.7_**
You will need to set additional configuration for your hardened cluster environment.
You will need to set additional configuration for your hardened cluster environment.
>**Note:** You must update your config in both RKE2 and K3s hardened clusters as shown below.
>**Note:** You must update your config in both RKE2 and K3s hardened clusters as shown below.
1. Click **☰ > Cluster Management**.
1. Go to the cluster that you created and click **Explore**.
1. In the left navigation bar, click **Apps & Marketplace**.
1. Install (or upgrade to) NeuVector version `100.0.1+up2.2.2`.
1. Click **☰ > Cluster Management**.
1. Go to the cluster that you created and click **Explore**.
1. In the left navigation bar, click **Apps & Marketplace**.
1. Install (or upgrade to) NeuVector version `100.0.1+up2.2.2`.
- Under **Edit Options** > **Other Configuration**, enable **Pod Security Policy** by checking the box. Note that you must also enter a value greater than `zero` for `Manager runAsUser ID`, `Scanner runAsUser ID`, and `Updater runAsUser ID`:
- Under **Edit Options** > **Other Configuration**, enable **Pod Security Policy** by checking the box. Note that you must also enter a value greater than `zero` for `Manager runAsUser ID`, `Scanner runAsUser ID`, and `Updater runAsUser ID`:
![Enable PSP for RKE2 and K3s Hardened Clusters](/img/psp-nv-rke2.png)
![Enable PSP for RKE2 and K3s Hardened Clusters](/img/psp-nv-rke2.png)
1. Click **Install** at the bottom-right to complete.
1. Click **Install** at the bottom-right to complete.
{{% /tab %}}
{{% /tabs %}}
</TabItem>
</Tabs>
### SELinux-enabled Cluster Support - Calico and Canal
docs/getting-started/installation-and-upgrade/install-upgrade-on-a-kubernetes-cluster/rancher-on-gke.md
+13 -13
View File
@@ -73,24 +73,24 @@ To install `gcloud` and `kubectl`, perform the following steps:
- Using gcloud config, to individually set your project ID, zone, and region.
<Tabs>
<TabItem value="Using gcloud init">
<TabItem value="Using gcloud init">
1. Run gcloud init and follow the directions:
1. Run gcloud init and follow the directions:
```
gcloud init
```
If you are using SSH on a remote server, use the --console-only flag to prevent the command from launching a browser:
```
gcloud init
```
If you are using SSH on a remote server, use the --console-only flag to prevent the command from launching a browser:
```
gcloud init --console-only
```
2. Follow the instructions to authorize gcloud to use your Google Cloud account and select the new project that you created.
```
gcloud init --console-only
```
2. Follow the instructions to authorize gcloud to use your Google Cloud account and select the new project that you created.
</TabItem>
<TabItem value="Using gcloud config">
</TabItem>
</TabItem>
<TabItem value="Using gcloud config">
</TabItem>
</Tabs>
# 4. Confirm that gcloud is configured correctly